Open the Users screen on a typical small business WordPress site and you’ll often find five or six Administrators: the owner, the owner’s partner, a staff member who once updated the opening hours, the developer from 2019, an SEO company that stopped invoicing two years ago, and an account called “test”. Every one of those is a full set of keys to the site.
Keep Administrator for the owner and whoever currently maintains the site, and give everyone else Editor, Author or Shop Manager. Fixing it takes about 20 minutes, and it’s one of the cheapest security improvements you can make.
What each role can do
WordPress comes with five standard roles on a normal site (plus Super Admin on multisite networks). The official roles and capabilities documentation has the full detail. In practical terms:
| Role | What they can do | Give it to |
|---|---|---|
| Administrator | Everything: install plugins, change settings, add and delete users, edit any content | The business owner and the developer currently looking after the site. Usually two people, rarely more than three |
| Editor | Create, edit, publish and delete any page or post, including other people’s. Manage categories and comments. No access to plugins, themes, settings or users | A staff member who manages the website content day to day |
| Author | Write, publish and edit their own posts, and upload images. Can’t touch pages or other people’s posts | Staff who write blog posts or news under their own name |
| Contributor | Write and edit their own posts, but can’t publish them or upload images. Someone else must review and publish | Guest writers, junior staff, anyone whose writing should be checked first |
| Subscriber | Log in and manage their own profile. Nothing else | Members or customers on sites that need logins |
Plugins add their own roles too. WooCommerce adds Shop Manager, which can run orders, products and customers without full Administrator access, plus Customer for people who buy from you. That Shop Manager role is exactly what most staff who pack orders need.
Who should get what
A few common situations, and what we’d set up:
The office manager who updates staff profiles, opening hours and the odd news post. Editor. They can change any page content without being able to install a plugin or delete a user.
A staff member writing a monthly blog post. Author, so the posts sit under their name and they can’t accidentally edit the homepage.
A practitioner who wants to write but needs the practice manager to check for compliance first. Contributor. Their drafts wait for an Editor to review and publish. For health practices with advertising rules to think about, this is a useful safety net.
Your SEO contractor. Usually Editor is enough to change page content, titles and meta descriptions. If they genuinely need to change plugin settings, give them Administrator for the job and downgrade them afterwards.
A designer making a one-off change. A temporary Administrator account in their own name, deleted when the work is done.
Your bookkeeper or someone checking WooCommerce orders. Shop Manager if they need to process orders. If they only need reports, ask whether they can get them another way.
Two rules make all of this work. Every person gets their own account, never a shared login, so you can see who changed what and remove one person without changing everyone’s password. And nobody gets a higher role just because it’s easier to set up.
Elementor and roles
On Elementor sites there’s an extra layer. Elementor’s Role Manager lets an Administrator choose which roles can use the Elementor editor at all. With Elementor Pro, you can also restrict a role to editing content only, so a staff member can change text and images without moving sections, deleting widgets or wrecking the layout.
For clients who edit their own sites, this is often the best of both worlds. They can update the words, and the design stays intact.
When someone leaves
This is where most sites fall down. Staff move on, contractors finish, agencies are replaced, and their accounts stay live for years.
When anyone with website access leaves, work through this the same week:
- Delete their WordPress user. When you delete a user, WordPress asks what to do with their content. Choose to attribute it to another user, otherwise their posts and pages are deleted with them.
- Check application passwords. These let apps and integrations log in without the main password. They’re listed on each user’s profile, and the application passwords documentation explains how they work. Deleting the user removes theirs, but check other accounts for any they may have set up.
- Change any shared passwords they knew. Hosting, domain registrar, email and anything else that wasn’t in their own name.
- Check form notifications. If their email address receives contact form or order notifications, change it, or enquiries will keep going to someone who’s left.
- Look at the admin email address under Settings > General. This receives password resets and security notices, and it should belong to the business, not a person who’s gone.
- Check other tools. Google Analytics, Search Console, Google Business Profile, Meta Business Suite. A departed staff member who still owns your Business Profile is a much bigger headache than a stray WordPress account, and recovering ownership is a regular part of our Google Business Profile work.
The bigger picture of who should hold which keys is in who should own your domain, hosting and logins.
A quick audit you can do now
Go to Users in your dashboard, filter by Administrator, and ask of each name: is this person still involved, and do they need this much access? Downgrade or delete as needed. Then do the same for Editors.
While you’re there, make sure every remaining Administrator and Editor has a strong unique password and two-factor login switched on. The rest of the security basics are in WordPress security for business owners.
Handover training on our web design builds is a good moment to set roles up properly from day one. If you’ve inherited a site and aren’t sure who has access to it, a user audit is a quick WordPress fix, and we can help you sort it out.